{"id":13259,"date":"2016-10-18T09:00:55","date_gmt":"2016-10-18T13:00:55","guid":{"rendered":"https:\/\/www.kaspersky.co.za\/blog\/?p=13259"},"modified":"2019-11-15T13:47:34","modified_gmt":"2019-11-15T11:47:34","slug":"biometric-atms","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.za\/blog\/biometric-atms\/13259\/","title":{"rendered":"Is biometric banking secure?"},"content":{"rendered":"<p>Biometric identification \u2014 using unique physical attributes such as fingerprints to authenticate people \u2014 has been considered secure for a long time. As such, the technology is very appealing to banks and bank users, which together make up a gigantic target for cybercriminals.<\/p>\n<p>In fact, many banks are already testing new ATMs with biometric access \u2014 or have plans to do so soon.<\/p>\n<p>On the institutional side, the great advantage of such methods as iris scanning or <a href=\"https:\/\/en.wikipedia.org\/wiki\/Vein_matching\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">vein matching<\/a> is that they decrease false reject (<a href=\"https:\/\/en.wikipedia.org\/wiki\/Type_I_and_type_II_errors#Biometrics\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">type I<\/a>) and false accept (<a href=\"https:\/\/en.wikipedia.org\/wiki\/Type_I_and_type_II_errors#Biometrics\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">type II<\/a>) rate errors. Users like biometrics because the technology works fast and frees them from dealing with passwords and other secret codes.<\/p>\n<p>Unfortunately, fingerprint-scanning technology is both massively widespread and <a href=\"https:\/\/www.kaspersky.co.za\/blog\/biometric-authentication\/2520\/\" target=\"_blank\" rel=\"noopener noreferrer\">not as reliable<\/a> as it should be. For example, users of both iOS and Android devices regularly complain that their gadgets refuse to unlock for authorized users \u2014 or that they let in other people.<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe class=\"youtube-player\" type=\"text\/html\" width=\"640\" height=\"390\" src=\"https:\/\/www.youtube.com\/embed\/HM8b8d8kSNQ?version=3&amp;rel=1&amp;fs=1&amp;showsearch=0&amp;showinfo=1&amp;iv_load_policy=1&amp;wmode=transparent\" frameborder=\"0\" allowfullscreen=\"true\"><\/iframe><\/span><\/p>\n<h3>What about ATMs?<\/h3>\n<p>Biometric ATMs are not yet implemented anywhere, but our security experts Olga Kochetova and Alexey Osipov have already <a href=\"https:\/\/securelist.com\/files\/2016\/09\/Future_ATM_attacks_report_eng.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">discovered<\/a> more than a dozen underground developers selling biometric <a href=\"https:\/\/www.kaspersky.co.za\/blog\/skimmers-part-one\/7223\/\" target=\"_blank\" rel=\"noopener noreferrer\">skimmers<\/a> on the black market. These devices are meant to steal scanned fingerprints.<\/p>\n<p>Other underground developers are looking to make devices that can intercept the results of iris scanning and vein matching. Moreover, using skimmers is not the only way to steal biometric data. <a href=\"https:\/\/www.kaspersky.co.za\/blog\/man-in-the-middle-attack\/1613\/\" target=\"_blank\" rel=\"noopener noreferrer\">Man-in-the-middle attacks<\/a> and similar methods will be just as effective with biometric credentials as they are now with usernames and passwords.<\/p>\n<p>Of course, criminals also hack servers with users\u2019 data, regardless of the form of that data.<br>\nConsider that this year Dropbox lost data from about <a href=\"https:\/\/www.kaspersky.co.za\/blog\/dropbox-hack\/12875\/\" target=\"_blank\" rel=\"noopener noreferrer\">60 million accounts<\/a>, and later Yahoo <a href=\"https:\/\/www.kaspersky.co.za\/blog\/yahoo-hack-complexity-growing\/13082\/\" target=\"_blank\" rel=\"noopener noreferrer\">acknowledged<\/a> the leak of 500 million \u2014 and those are just two examples of many.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">More bad news from the <a href=\"https:\/\/twitter.com\/hashtag\/Yahoohack?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Yahoohack<\/a> <a href=\"https:\/\/t.co\/neicHoAHh0\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/neicHoAHh0<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/infosec?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#infosec<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/yahoo?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#yahoo<\/a> <a href=\"https:\/\/t.co\/zl6dOXe5gu\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/zl6dOXe5gu<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/780789221095276544?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">September 27, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Now, imagine that instead of passwords those companies had lost their users\u2019 biometric data. Changing passwords may be annoying, but you can\u2019t replace your DNA.<\/p>\n<p>In addition, with the help of biometric skimmers, criminals can use raw data to <a href=\"https:\/\/www.kaspersky.co.za\/blog\/fingerprints-sensors-security\/10951\/\" target=\"_blank\" rel=\"noopener noreferrer\">craft a counterfeit login sample<\/a>. Banks will need to work out security standards very thoroughly before they launch biometric ATMs.<\/p>\n<h3>Biometric security\u2019s downward slide<\/h3>\n<p>The use of biometrics began with governments, security forces, and the defense industry. In these fields biometrics proved reliable, primarily because the institutions could afford expensive, first-class equipment.<\/p>\n<p>With widespread adoption of biometrics, however, we have seen its amazing security slip. The technology\u2019s popularity is actually a major contributing factor to this slide, for two reasons. First, security specification standards for consumer goods are lower than they are in mission-critical implementations. Second, a broad field of easily obtainable gadgets gives criminals a huge test bed of consumer devices to experiment with and find more and more vulnerabilities \u2014 for their own benefit, of course. The rapid development of 3D printing has also contributed to biometrics\u2019 <a href=\"https:\/\/www.kaspersky.co.za\/blog\/stealing-digital-identity\/10386\/\" target=\"_blank\" rel=\"noopener noreferrer\">vulnerability<\/a>.<\/p>\n<p>Last year people installed about 6 million mobile apps that supported fingerprint authentication. According to Juniper Research, by 2019 humanity will use about <a href=\"https:\/\/www.juniperresearch.com\/press\/press-releases\/biometric-authentication-app-downloads-to-reach-77\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">770 million such apps<\/a>. By that time, biometric authentication will be commonplace. Other experts are even more optimistic: Acuity Market Intelligence <a href=\"http:\/\/www.acuity-mi.com\/GBMR_Report.php\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">believes<\/a> that by 2020, 2.5 billion people will use 4.8 billion biometric devices.<\/p>\n<h3>Hope \u2014 and recommendations \u2014 for the future<\/h3>\n<p>Fortunately, biometric data is not stored as is: A server receives only <a href=\"https:\/\/www.kaspersky.co.za\/blog\/the-wonders-of-hashing\/4441\/\" target=\"_blank\" rel=\"noopener noreferrer\">hashed<\/a> scanning results, making outright theft a less-attractive option. Nonetheless, criminals can still use methods such as the abovementioned man-in-the-middle attack, inserting themselves into the data transfer channel between an ATM and a processing center to steal users\u2019 money.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">RT <a href=\"https:\/\/twitter.com\/emm_david?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@emm_david<\/a>: 4 ways to hack an ATM: <a href=\"https:\/\/t.co\/tsZDBfnu04\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/tsZDBfnu04<\/a> via <a href=\"https:\/\/twitter.com\/kaspersky?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@kaspersky<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/783291987722108932?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">October 4, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Ultimately, banks and users will need to continue to employ stringent security measures against breaches of traditional logins as well as adding protection from biometric fraud. On the business side, that includes improving ATM design so as to prevent the installation of skimmers, as well as establishing and maintaining control over the security of <a href=\"https:\/\/usa.kaspersky.com\/blog\/4-ways-to-hack-atm\/7720\/\" target=\"_blank\" rel=\"noopener noreferrer\">ATM hardware<\/a> and software.<\/p>\n<p>As for biometric identification technology in general, for now we recommend everybody use it as a secondary protection method that complements other security measures, but does not replace them completely.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>ATMs will soon use fingerprint readers and iris sensors to identify customers. But is biometric authentication as secure as advertised?<\/p>\n","protected":false},"author":2411,"featured_media":13260,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,2670],"tags":[401,359,1851,722,1232,1269],"class_list":{"0":"post-13259","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"tag-atm","10":"tag-authentication","11":"tag-authorization","12":"tag-banks","13":"tag-biometrics","14":"tag-fingerprints"},"hreflang":[{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/biometric-atms\/13259\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/biometric-atms\/7803\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/biometric-atms\/7816\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/biometric-atms\/7844\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/biometric-atms\/9326\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/biometric-atms\/9166\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/biometric-atms\/13378\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/biometric-atms\/13259\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/biometric-atms\/6254\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/biometric-atms\/6683\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/biometric-atms\/5559\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/biometric-atms\/8977\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/biometric-atms\/12933\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/biometric-atms\/13378\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/biometric-atms\/13259\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.co.za\/blog\/tag\/biometrics\/","name":"biometrics"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/posts\/13259","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/users\/2411"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/comments?post=13259"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/posts\/13259\/revisions"}],"predecessor-version":[{"id":24239,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/posts\/13259\/revisions\/24239"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/media\/13260"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/media?parent=13259"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/categories?post=13259"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/tags?post=13259"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}